{"id":"CVE-2026-119636","kind":"vulnerability","aliases":["CVE-2026-119636"],"related":[],"title":"Devolutions Server: expired PAM checkouts keep account access after checkout ends","description":"Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.","summary":"Devolutions Server 2025.3.2.0 through 2026.2.22.0 fails to check in expired privileged account checkouts when there is a backlog of 21 or more newer active checkouts. An authenticated user with checkout rights keeps access to the target account after the checkout should have expired, and its password is not rotated.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devolutions-server","package","pam","windows"],"not_affected_if":["no-pam-checkouts","versions-outside-range"],"how_to_check":"- Confirm the installed Devolutions Server version is within `2025.3.2.0` through `2026.2.22.0`.\n- Review PAM checkout logs for expired checkouts that were never checked in or rotated while many newer checkouts were active.","fix":"- Devolutions Server versions after `2026.2.22.0` are reported as affected-range boundary; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-03T21:17:02+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","triaged_at":"2026-11-03T21:27:43+00:00","updated_at":"2026-11-03T21:27:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T21:27:43Z","model":"claude-haiku-5-5","output":{"fix":"- Devolutions Server versions after `2026.2.22.0` are reported as affected-range boundary; the exact fixed version is unknown from the sources.","reach":"network","title":"Devolutions Server: expired PAM checkouts keep account access after checkout ends","impact":"medium","summary":"Devolutions Server 2025.3.2.0 through 2026.2.22.0 fails to check in expired privileged account checkouts when there is a backlog of 21 or more newer active checkouts. An authenticated user with checkout rights keeps access to the target account after the checkout should have expired, and its password is not rotated.","audience":"businesses","category":"package","nicknames":[],"who_cares":["devolutions-server","pam","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"former user keeps privileged access to a target account","analyst_note":"Confirm the fixed version and whether a patch or setting exists; the NVD entry alone does not state it: https://nvd.nist.gov/vuln/detail/CVE-2026-119636","how_to_check":"- Confirm the installed Devolutions Server version is within `2025.3.2.0` through `2026.2.22.0`.\n- Review PAM checkout logs for expired checkouts that were never checked in or rotated while many newer checkouts were active.","plain_action":"","needs_analyst":true,"not_affected_if":["no-pam-checkouts","versions-outside-range"],"who_is_affected":"Teams that run Devolutions Server with the PAM feature and let users check out privileged accounts. The exposure needs a backlog of 21 or more active checkouts, so smaller deployments are less likely to be hit. unknown whether other Devolutions products are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4154,"output_tokens":634,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119636':14A,17A '-2026':13A,16A '2025.3.2.0':26B,91C '2026.2.22.0':28B,93C '21':43B,123C 'access':8A,56B,78C,107C 'account':7A,35B,60B,104C,110C 'activ':47B,127C 'allow':94C 'authent':50B,96C 'backlog':41B,121C 'check':31B,85C,136C 'check-in':84C 'checkout':5A,10A,36B,48B,53B,63B,79C,99C,117C,128C,133C 'cve':12A,15A 'devolut':1A,19B,24B,89C 'devolutions-serv':18B 'end':11A 'expir':3A,33B,66B,76C,118C,132C 'fail':29B 'improp':73C 'keep':6A,55B 'newer':46B,126C 'packag':21B 'pam':4A,22B,82C,103C 'password':69B,140C 'prevent':130C 'privileg':34B,77C 'releas':74C 'retain':106C 'right':54B,100C 'rotat':72B,143C 'schedul':83C 'server':2A,20B,25B,90C 'system':114C 'target':59B,113C 'task':87C 'user':51B,97C 'via':119C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Devolutions Server with the PAM feature and let users check out privileged accounts. The exposure needs a backlog of 21 or more active checkouts, so smaller deployments are less likely to be hit. unknown whether other Devolutions products are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["devolutionsserver","medium","package","pam","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119636","severity":null,"published_at":"2026-11-03T21:17:02+00:00","modified_at":"2026-11-03T21:17:03+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","fetched_at":"2026-11-03T21:19:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}